An internet traffic classification method, apparatus and device

Abstract

The application relates to an Internet traffic classification method, device and equipment, and belongs to the technical field of computer network security. The application determines a first data packet sequence from a traffic training data set in a session flow unit, wherein one session flow corresponds to one first data packet sequence; a first to-be-trained model is subjected to model training according to the first data packet sequence, so that a trained flow feature multilayer perception machine classification model is obtained; and a second to-be-trained model is subjected to model training according to the first data packet sequence, so that a trained flow data multilayer perception machine classification model is obtained. Since the trained flow feature multilayer perception machine classification model and the flow data multilayer perception machine classification model are used to classify network traffic, the expert assistance is not needed in the use process, and therefore the Internet traffic classification efficiency and accuracy can be improved.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of computer network security, and particularly relates to an Internet traffic classification method, device and equipment. BACKGROUND

[0002] With the rapid development of the Internet, various network services and applications emerge in endlessly. Meanwhile, rogue software, malicious programs and network criminal activities continuously pose a threat to cyberspace. In order to improve the network threat response and processing capacity, the ability to identify network data flow types and specific applications is usually required.

[0003] At present, identifying network data flow types and specific applications faces great challenges. From a technical point of view, on the one hand, due to the increasing trend of Internet traffic encryption and the increasing use of VPN (Virtual Private Network, which establishes a private network on a public network for encrypted communication) and TOR (The Onion Router, which is a second-generation implementation of the Onion Router, and users can communicate anonymously on the Internet through TOR), network traffic classification becomes more difficult. On the other hand, the current network traffic presents an explosive growth, and the network traffic data presents the characteristics of mass and high speed. How to realize the real-time identification of large-scale network traffic is also one of the difficulties.

[0004] Traffic classification technology includes traditional port-based classification technology, payload-based classification technology, and statistical and machine learning-based classification technology. The main drawback of all these classification technologies is that these technologies need to be completed with the help of experts in the process of use, so they have the problems of low efficiency and poor accuracy. SUMMARY

[0005] The present application provides an Internet traffic classification method and device, which helps to solve the problem of low efficiency and low accuracy due to the need for expert help in the process of using the existing classification technology.

[0006] To achieve the above purpose, the present application adopts the following technical solutions:

[0007] In a first aspect, the present application provides an Internet traffic classification method, comprising:

[0008] obtaining a traffic training data set;

[0009] determining a first data packet sequence from the traffic training data set in units of session flows, wherein one session flow corresponds to one first data packet sequence;

[0010] According to the first data packet sequence, a first to-be-trained model is trained to obtain a trained flow feature multilayer perception machine classification model; and according to the first data packet sequence, a second to-be-trained model is trained to obtain a trained flow data multilayer perception machine classification model.

[0011] The flow feature multilayer perception machine classification model is used to obtain a flow feature classification result, the flow data multilayer perception machine classification model is used to obtain a flow data classification result based on an original flow data by using an attention mechanism and a multilayer perception machine, and the flow feature classification result and the flow data classification result are used to obtain a final classification result.

[0012] Further, according to the first data packet sequence, a first to-be-trained model is trained to obtain a trained flow feature multilayer perception machine classification model, including:

[0013] Flow feature information is obtained from the first data packet sequence data.

[0014] The flow feature information is sent to the first to-be-trained model for training to obtain the trained flow feature multilayer perception machine classification model.

[0015] Further, according to the first data packet sequence, a second to-be-trained model is trained to obtain a trained flow data multilayer perception machine classification model, including:

[0016] The first data packet sequence is length-corrected to obtain a second data packet sequence with a preset length.

[0017] An image set is determined according to the second data packet sequence.

[0018] The image set is sent to the second to-be-trained model for training to obtain the trained flow data multilayer perception machine classification model.

[0019] Further, the image set is determined according to the second data packet sequence, including:

[0020] A first image is constructed according to a data packet arrival time and a data packet size of the second data packet sequence.

[0021] A second image is constructed according to a data packet arrival time and a data packet data preset length byte of the second data packet sequence.

[0022] The first image and the second image are superimposed to generate a double-channel image.

[0023] Further, the second to-be-trained model at least includes an image block full connection layer, an attention perception layer, a global average pooling layer and a full connection layer.

[0024] The image set is input into the second to-be-trained model for training to obtain the trained stream data multilayer perceptron classification model, comprising:

[0025] The double-channel image is converted into a linearly flattened image piece sequence through the image block full connection layer;

[0026] The linearly flattened image piece sequence is input into the attention perception layer, so that the attention perception layer performs at least one layer of attention perception layer operation on the linearly flattened image piece sequence to obtain an initial operation result;

[0027] The initial operation result is sequentially input into a global average pooling layer and a full connection layer to obtain a target classification result, and the target classification result is a target operation result;

[0028] Based on the target real category, a loss is calculated for model training to obtain the trained stream data multilayer perceptron classification model. Specifically, based on the target real category, a loss is calculated for model training, which means that the target real category and the target classification result are substituted into a loss function to calculate a loss value, and the model is trained based on the loss value.

[0029] Further, the stream feature classification result and the stream data classification result are further fused through a model to obtain the final classification result.

[0030] Further, the method further comprises:

[0031] Obtaining a to-be-predicted session stream data packet sequence corresponding to to-be-predicted traffic data;

[0032] Using the to-be-predicted session stream data packet sequence, the stream feature multilayer perceptron classification model and the stream data multilayer perceptron classification model are model-predicted to obtain a model prediction result.

[0033] Further, the method comprises:

[0034] Obtaining a to-be-identified session stream data packet sequence corresponding to to-be-identified traffic;

[0035] Based on the stream feature multilayer perceptron classification model of any one of the above, a target stream feature classification result of the to-be-identified session stream data packet sequence is obtained; and based on the stream data multilayer perceptron classification model of any one of the above, a target stream data classification result of the to-be-identified session stream data packet sequence is obtained;

[0036] According to the target stream feature classification result and the target stream data classification result, a target classification result of the to-be-identified session stream data packet sequence is generated.

[0037] In a second aspect, the present application provides an Internet traffic classification device, comprising a traffic classification module.

[0038] The traffic classification module is configured to execute the method described above.

[0039] In a third aspect, the present application provides an Internet traffic classification device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described above.

[0040] The present application has at least the following beneficial effects by adopting the above technical solutions:

[0041] The present application obtains a traffic training data set, determines a first data packet sequence from the traffic training data set in units of session flows, wherein one session flow corresponds to one first data packet sequence, and data preprocessing is very simple; according to the first data packet sequence, a first to-be-trained model and a second to-be-trained model are trained to obtain a trained flow feature multilayer perception machine classification model and a trained flow data multilayer perception machine classification model, respectively, and the trained model mainly comprises a multilayer perception machine module, has a simpler structure than CNN and RNN, is mainly composed of basic matrix multiplication operations, and is therefore easier to implement and has a higher inference speed; the flow feature multilayer perception machine classification model is used to obtain a flow feature classification result, the flow data multilayer perception machine classification model is used to obtain a flow data classification result based on an attention mechanism, and the flow feature classification result and the flow data classification result are used to integrate a final classification result. In addition, the trained flow feature multilayer perception machine classification model and the flow data multilayer perception machine classification model are used to classify network traffic during prediction, and no expert assistance is required during use, so that the Internet traffic classification efficiency and accuracy can be improved.

[0042] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and cannot limit the present application. BRIEF DESCRIPTION OF DRAWINGS

[0043] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the drawings needed in the embodiment or prior art description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and those skilled in the art can also obtain other drawings according to these drawings without creative labor.

[0044] Figure 1 is a flow chart of an Internet traffic classification method according to an exemplary embodiment;

[0045] Figure 2is a whole architecture diagram of an internet traffic classification method according to an exemplary embodiment;

[0046] Figure 3 is a general structure diagram of a flow data multi-layer perception machine classification model according to an exemplary embodiment;

[0047] Figure 4 is a structure diagram of an attention perception layer according to an exemplary embodiment;

[0048] Figure 5 is a structure diagram of a multi-layer perception machine in the attention perception layer according to an exemplary embodiment;

[0049] Figure 6 is a structure diagram of an attention module in the attention perception layer according to an exemplary embodiment;

[0050] Figure 7 is a block diagram schematic view of an internet traffic classification device according to an exemplary embodiment;

[0051] Figure 8 is a block diagram schematic view of an internet traffic classification device according to an exemplary embodiment. DETAILED DESCRIPTION

[0052] In order to make the purposes, technical solutions and advantages of the present application clearer, the technical solutions of the present application will be described in detail below. Obviously, the described embodiments are only some of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0053] Please refer to Figure 1 , Figure 1 is a flow chart of an internet traffic classification method according to an exemplary embodiment, as shown in Figure 1 , the method comprises the following steps:

[0054] Step S11, obtaining a traffic training data set;

[0055] Step S12, determining a first data packet sequence from the traffic training data set in a session flow unit, wherein one session flow corresponds to one first data packet sequence;

[0056] Step S13, performing model training on a first to-be-trained model according to the first data packet sequence to obtain a trained flow feature multi-layer perception machine classification model, and performing model training on a second to-be-trained model according to the first data packet sequence to obtain a trained flow data multi-layer perception machine classification model;

[0057] The flow feature multi-layer perception classification model is used to obtain a flow feature classification result, and the flow data multi-layer perception classification model is used to obtain a flow data classification result by using an attention mechanism and a multi-layer perception, and the flow feature classification result and the flow data classification result are used to obtain a final classification result.

[0058] In this embodiment, the execution subject can be a terminal device, a server, or other electronic equipment.

[0059] In this embodiment, the traffic training data set contains multiple traffic training data, which can be traffic data generated during actual network transmission. The traffic training data is used as a training sample for model training in this embodiment.

[0060] In this embodiment, the first data packet sequence is a sequence composed of multiple data packets determined from the traffic training data set, and one session flow corresponds to one first data packet sequence.

[0061] In this embodiment, as shown in Figure 2 The flow feature multi-layer perception classification model can classify the flow features corresponding to each data packet contained in the first data packet sequence to obtain a flow feature classification result. The flow features herein refer to traffic features obtained from the packet header, including packet-level features, session features, statistical features, etc. In this embodiment, the flow features can include but are not limited to server domain name information carried in the Server Name Indicator (SNI) extension field during client and server session handshake, TCP window size, average interval time between packets, and average packet length. The obtained flow feature classification result can be regarded as a probability value of the network traffic category and application category matching the features of the session flow corresponding to the data packet sequence.

[0062] In this embodiment, as shown in Figure 2 The flow data multi-layer perception classification model can classify the original data packet data contained in the first data packet sequence to obtain a flow data classification result. In this embodiment, the original data packet size and the preset byte length of the data packet are extracted by preprocessing the original data packet data to generate corresponding images. The obtained flow data classification result can be regarded as a probability value of the network traffic category and application category corresponding to the original data packet data contained in the data packet sequence.

[0063] In this embodiment, as shown in Figure 2As shown, the final classification result is obtained by model fusion according to the flow feature classification result and the flow data classification result. The model fusion is to obtain the weighted average value of the probability values corresponding to the flow feature classification result and the flow data classification result according to the category, and obtain the final probability value corresponding to each category. Then, the category with the maximum probability in the final probability value corresponding to each category is taken as the final classification result.

[0064] Specifically, the execution subject obtains a flow training data set, processes the obtained flow training data set to obtain a first data packet sequence, and finally sends the first data packet sequence into a first to-be-trained model and a second to-be-trained model for model training to obtain a trained flow feature multilayer perceptron classification model and a flow data multilayer perceptron classification model. The flow feature multilayer perceptron classification model and the flow data multilayer perceptron classification model are both multilayer perceptron classification models, and the flow data multilayer perceptron classification model is a multilayer perceptron classification model with an attention mechanism. The attention mechanism can selectively focus on part of all information and can more effectively extract key information.

[0065] The application models the network session flow feature field by using the flow feature multilayer perceptron classification model to improve the accuracy of traffic classification. By using the flow data multilayer perceptron deep learning model to convert the network session flow into an image, automatic feature recognition and extraction are realized, and the efficiency of identifying and extracting features from traffic is improved by using the self-learning mode of the deep learning algorithm. In addition, the flow data multilayer perceptron deep learning model in the application automatically obtains the importance of each feature channel by adding a self-attention structure, thereby helping to reduce the number of layers of the intermediate model, reduce the parameters of the entire network, and improve the performance and accuracy.

[0066] In one embodiment, for step S11, a flow training data set is obtained. In actual application, the flow training data set is composed of captured network traffic data packets, and each network traffic data packet corresponds to a specific application name, traffic type and encryption technology.

[0067] For step S12, a first data packet sequence is determined from the flow training data set in a session flow unit, wherein one session flow corresponds to one first data packet sequence. In actual application, the first data packet sequence is obtained by dividing the obtained flow training data set in a session flow unit, wherein a plurality of session flows can be determined in the flow training data set, and one session flow corresponds to one first data packet sequence. In this embodiment, the first data packet sequence is composed of the first W data packets of a session flow and the removal of the data link layer bytes.

[0068] For step S13, a first to-be-trained model is trained according to the first data packet sequence to obtain a trained flow feature multilayer perception classification model, and a second to-be-trained model is trained according to the first data packet sequence to obtain a trained flow data multilayer perception classification model; the flow feature multilayer perception classification model is used to obtain a flow feature classification result, the flow data multilayer perception classification model is used to obtain a flow data classification result based on an attention mechanism, and the flow feature classification result and the flow data classification result are used to obtain a final classification result.

[0069] Specifically, the first to-be-trained model is trained according to the first data packet sequence to obtain the trained flow feature multilayer perception classification model, including: obtaining flow feature information from the first data packet sequence data; and sending the flow feature information to the first to-be-trained model for training to obtain the trained flow feature multilayer perception classification model.

[0070] In actual application, the first to-be-trained model can be a flow feature traffic classification model based on a multilayer perception, and the flow feature traffic classification model has a structure of an input layer, one or more hidden layers, and an output layer, and the different neural network layers are fully connected. For the first data packet sequence, flow feature information is extracted, and the extracted flow feature information is sent to the flow feature traffic classification model for training to obtain a flow feature classification result. Based on the flow feature classification result, the model is trained by a back propagation method, the model parameters are adjusted, and the trained flow feature multilayer perception classification model is obtained.

[0071] In this embodiment, the extracted flow feature includes server domain name information carried in a Server Name Indicator (SNI) extension field during a handshake of a client and a server, a TCP window size, an average interval time between packets, and an average packet length. For the SNI feature, the SNI feature is hashed into an ID, is converted into an embedding vector through an embedding layer, and is spliced with a numerical feature to serve as an input of the first to-be-trained model.

[0072] Further, the second to-be-trained model is trained according to the first data packet sequence to obtain the trained flow data multilayer perception classification model, including:

[0073] The first data packet sequence is length-corrected to obtain a second data packet sequence with a preset length.

[0074] An image set is determined according to the second data packet sequence.

[0075] The image set is sent to the second to-be-trained model for training, and a trained flow data multilayer perception classification model is obtained.

[0076] In actual application, the second to-be-trained model can be a flow data traffic classification model based on multilayer perception. The first data packet sequence is length-corrected to obtain a second data packet sequence with a preset length; an image set is determined according to the second data packet sequence; the determined image set is sent to the flow data traffic classification model for training, and a flow data classification result is obtained. Based on the flow data classification result, the model is trained by using the back propagation method, and the model parameters are adjusted to obtain the trained flow data multilayer perception classification model. As shown in FIG. 2, the trained flow data multilayer perception classification model at least includes an image block full connection layer, a plurality of attention perception layers (AttMLP Layer), a global average pooling layer, and a full connection layer. Figure 3

[0077] The second data packet sequence with the preset length is a data packet sequence with a uniform length generated by length-correcting the first data packet sequence. The length of the second data packet sequence can be set according to actual application.

[0078] As an optional implementation, length-correcting the first data packet sequence to obtain the second data packet sequence with the preset length can include: determining the number of bytes corresponding to the first data packet sequence; comparing the number of bytes of the first data packet sequence with a preset number of bytes; if the number of bytes of the first data packet sequence is greater than the preset number of bytes, truncating target bytes exceeding the preset number of bytes in the first data packet sequence to obtain the second data packet sequence; and if the number of bytes of the first data packet sequence is less than the preset number of bytes, performing a zero padding operation on the first data packet sequence until the first data packet sequence reaches the preset number of bytes.

[0079] In this embodiment, the preset number of bytes is set to H bytes. When the data length of the data packet does not reach the set data length, a zero value is padded at the end of the data, and data is truncated to the set H-byte data content when the data length is greater than the data length. The preset length of the data packet can be set according to actual application. By implementing this optional implementation, the data length of the data packet sequence can be unified.

[0080] Optionally, before length-correcting the first data packet sequence, a preprocessing operation can also be performed. After preprocessing the first data packet sequence, length correction is performed. Specifically, the preprocessing operation can include removing data packets that do not contain a payload. The data packets that do not contain a payload can be SYN, ACK, or FIN packet segments in the TCP three-way handshake connection establishment process. ​

[0081] Further, determining the image set according to the second data packet sequence comprises: constructing a first image according to the data packet arrival time and the data packet size of the second data packet sequence; constructing a second image according to the data packet arrival time and the data packet data preset length byte of the second data packet sequence; and superimposing the first image and the second image to generate a dual-channel image.

[0082] Specifically, the first image is constructed with the data packet arrival time of the second data packet sequence as the horizontal axis and the data packet size as the vertical axis, so that the value of the position <I, J> in the image is 1 when the size of the first data packet is J, and the value of other positions in the first column is 0; the second image is constructed with the data packet arrival time as the horizontal axis and the data packet data preset length byte as the vertical axis. The first image and the second image are superimposed to generate a dual-channel image of H*W*2, where H represents the data packet preset length and W represents the number of first data packet sequences.

[0083] Further, the dual-channel image is converted into a linearly flattened image patch sequence through the image block full connection layer.

[0084] Specifically, the dual-channel image of H*W resolution is divided into P*Q (P*Q represents the image block size) non-overlapping identical small blocks, which are then sent to the image block full connection layer, and the small block data is flattened and mapped into a C-dimensional vector through full connection, so that the output X is a two-dimensional tensor of T*C, T represents the number of blocks, C represents the image block feature vector, and X is a linearly flattened image patch sequence represented by the two-dimensional tensor of T*C.

[0085] In this embodiment, W=192 and H=768, and the image of 192*768*2 is first divided into a plurality of adjacent non-overlapping image blocks, and the image block size selected in this embodiment is 16*16, so that the image can be divided into 576 image blocks (192*768) / (16*16)=576). Combined with the number of channels, each image block contains 16*16*2=512 values, and the vector composed of the 512 values is input into a full connection layer to obtain a feature vector with a length of 128, thereby forming a two-dimensional tensor of T*C=576*128, where T is the number of image blocks and C is the image block feature vector.

[0086] Further, the linearly flattened image patch sequence is input into the attention perception layer, so that the attention perception layer performs at least one layer of attention perception layer operation on the linearly flattened image patch sequence to obtain an initial operation result.

[0087] Specifically, the generated linearly flattened image patch sequence X is input into the attention perception layer to perform multiple layers of attention perception layer operation to obtain an initial operation result X 4 , where the attention perception layer is composed of input and output layers with the same size.

[0088] As shown in Figure 4 , the attention-aware layer operation specifically proceeds as follows:

[0089] First, TxC is subjected to layer normalization processing and transpose processing, and then subjected to spatial mixing by a first multi-layer perceptron (MLP1). The spatial mixing is mixing in the spatial domain of different blocks in the same channel. Then, transposition is performed to generate a TxC tensor X 1 ; as shown in Figure 5 , the multi-layer perceptron (MLP) is composed of a fully connected layer, a GELU activation function, and a fully connected layer.

[0090] Further, X 1 is input into an attention module (Attention Module), which is subjected to a global pooling layer, a fully connected layer, and a Sigmoid activation function to generate a 1xC tensor y. The y is broadcasted along the first dimension to obtain a TxC tensor, which is element-wise multiplied with the original input X 1 to obtain a TxC tensor X 2 ; as shown in Figure 6 , the attention module is composed of a global pooling layer, a fully connected layer, a Sigmoid activation function, and a Scale operation. The Scale operation refers to element-wise multiplication of two tensors.

[0091] Further, after layer normalization of X 2 , channel mixing is performed by a second multi-layer perceptron (MLP2). The channel mixing is mixing of different channels in the same position to obtain a TxC tensor X 3 .

[0092] Further, X 3 is input into the attention module again, which is subjected to a global pooling layer, a fully connected layer, and a Sigmoid activation function to generate a 1xC tensor y ′ . The y ′ is broadcasted along the first dimension to obtain a TxC tensor, which is element-wise multiplied with the original input X 3 to obtain an initial operation result X 4 .

[0093] In actual applications, multiple attention-aware layer operations can be set. The specific number of operation layers can be set according to actual applications.

[0094] Further, the initial operation result is sequentially input into the global average pooling layer and the fully connected layer to obtain a target operation result, i.e., the trained flow data multi-layer perceptron classification model.

[0095] The initial operation result is sequentially input into the global average pooling layer and the fully connected layer to obtain a target operation result, that is, the trained flow data multilayer perceptron classification model. Specifically, the initial operation result X of TxC can be input into the global average pooling layer to obtain a C-dimensional vector. 4 The C-dimensional vector is input into the fully connected layer to obtain a flow data classification result. Based on the flow data classification result, the model is trained by using the back propagation method to adjust the model parameters, and the trained flow data multilayer perceptron classification model is obtained.

[0096] Further, the flow feature classification result and the flow data classification result are used to obtain the final classification result by model fusion.

[0097] Specifically, the flow feature classification result and the flow data classification result are fused by model fusion, that is, the probability values corresponding to the obtained flow feature classification result and the flow data classification result are weighted and averaged by category, and the category corresponding to the maximum value of all probability values is selected as the final classification result.

[0098] Further, the method further comprises:

[0099] Obtaining a to-be-predicted session flow data packet sequence corresponding to to-be-predicted traffic data;

[0100] Using the to-be-predicted session flow data packet sequence to perform model prediction on the flow feature multilayer perceptron classification model and the flow data multilayer perceptron classification model to obtain a model prediction result.

[0101] In the embodiment, the execution subject can be a terminal device, a server, or the like.

[0102] Specifically, the execution subject determines a first data packet sequence from the to-be-predicted traffic data in units of session flow, inputs the first data packet sequence into the trained flow feature multilayer perceptron classification model, performs model training, and obtains a flow feature classification result. The first data packet sequence is corrected in length to obtain a second data packet sequence, and the second data packet sequence is input into the flow data multilayer perceptron classification model to perform model training and obtain a flow data classification result. The flow feature classification result and the flow data classification result are fused by model fusion to obtain the final to-be-predicted traffic classification result.

[0103] Further, the method comprises:

[0104] Obtaining a to-be-identified session flow data packet sequence corresponding to to-be-identified traffic;

[0105] The flow feature multi-layer perception classification model based on any one of the above obtains a target flow feature classification result of the to-be-identified session flow data packet sequence; and the flow data multi-layer perception classification model based on any one of the above obtains a target flow data classification result of the to-be-identified session flow data packet sequence.

[0106] According to the target flow feature classification result and the target flow data classification result, a target classification result of the to-be-identified session flow data packet sequence is generated.

[0107] The Internet traffic classification result can include a result of classification according to application program names and traffic types, and the optional Internet traffic classification result can further include a result of classification according to encryption technologies. The following table is a specific classification result provided by the embodiment, which is a classification result according to application program names, traffic types and encryption technologies. The classification result between the application program name, the traffic type and the encryption technology corresponding to each network traffic data packet is shown in the following table:

[0108]

[0109] Among them, the encryption technology has VPN and TOR, and Non-VPN represents non-encryption; the traffic type has VoIP (audio), Video (video), File Transfer (file transfer), Chat (chat) and Browsing (web browsing); and the application program name has Google, Hangouts, Facebook.VoipBuster, Skype, FTPS, SCP, SFTP, AIM Chat, Skype, ICQ, WhatsApp Web, Firefox and Chrome, etc. As can be seen from the table, by using the Internet traffic classification method of the present application, network traffic can be classified according to traffic categories, encryption technologies and corresponding application program names to identify traffic categories and application categories.

[0110] The flow feature multi-layer perception classification model is used to model the network session flow feature field in the present application, so as to improve the accuracy of traffic classification. By using the flow data multi-layer perception deep learning model, the network session flow is converted into an image, automatic feature recognition and extraction are realized, the deep learning algorithm is used for self-learning, and the efficiency of feature recognition and extraction from traffic is improved. In addition, the flow data multi-layer perception deep learning model in the present application automatically obtains the importance of each feature channel by adding a self-attention structure, so as to help reduce the number of layers of the intermediate model, reduce the parameters of the entire network, and improve the performance and accuracy.

[0111] Please refer to Figure 7 , Figure 7is a block diagram of an Internet traffic classification device according to an exemplary embodiment, as shown in Figure 7 The Internet traffic classification device 7 includes a traffic access and preprocessing module 71, a traffic scheduling module 72, a session flow collection module 73, a traffic classification module 74, and a traffic log analysis module 75.

[0112] The traffic access and preprocessing module 71 is configured to implement large-scale network traffic data access from multiple access points and restore session flows based on captured network data traffic. The traffic scheduling module 72 is configured to complete session alignment based on a unidirectional flow alignment model and distribute traffic to the traffic identification and control unit according to a load balancing strategy. The session flow collection module 73 is configured to obtain network session flows in real time. The traffic classification module 74 is configured to perform an Internet traffic classification method and classify Internet traffic. The traffic log analysis module 75 is configured to generate network logs based on network traffic and analyze logs to mine multi-dimensional high-quality intelligence information.

[0113] As an optional implementation, in actual application, the traffic access and preprocessing module 71 accesses an operator backbone route in a series or parallel manner, collects original traffic message data of fixed networks and mobile networks from the backbone router, implements large-scale network traffic data access from multiple access points, and restores session flows based on captured network data traffic. The traffic message information can be copied to a specified port, and the port, port group, aggregation rules, and service strategies can be configured.

[0114] The traffic scheduling module 72 completes session alignment based on a unidirectional flow alignment model, reasonably distributes traffic based on session five-tuple hash and a dynamic load balancing algorithm.

[0115] The mode of distributing traffic includes two modes. One is traffic mirroring, which is copying specific types of messages to the session flow collection module 73. The other is traffic steering, which refers to forwarding specific types of messages to the session flow collection module 73, processing the messages by the traffic and application identification unit, and then injecting the messages back to the traffic access and preprocessing module 71.

[0116] Unidirectional flow alignment refers to aligning and matching unidirectional flows through a traffic alignment model, implementing scheduling all messages on the same session connection to the same session flow collection module 73. Unidirectional flow refers to network traffic in which request traffic and response traffic of the same session are distributed to different session flow collection modules 73. Unidirectional flow can cause incomplete session restoration and affect subsequent traffic identification and control operations.

[0117] The unidirectional flow alignment procedure is as follows:

[0118] Step S1, assign a fixed number IP to each traffic and application identification unit, and establish a mapping relationship between the traffic aggregation and distribution unit port and the fixed number IP;

[0119] Step S2, when receiving traffic, the traffic access and preprocessing module 71 extracts the information of the session five-tuple, and calculates the hash value of the session five-tuple according to the hash algorithm, and the same hash value corresponds to the same traffic and application identification unit IP;

[0120] Step S3, if the upstream and downstream of the same traffic have the same five-tuple information, then the traffic access and preprocessing module 71 will send them to the same traffic and application identification unit IP according to the same hash value;

[0121] Step S4, for the case where there are more than two traffic access and preprocessing modules 71, the uplink information of different sessions needs to be synchronized between different traffic access and preprocessing modules 71 (synchronization information accounts for about 10% of the total traffic) to handle the one-way flow problem across machine rooms or across operators.

[0122] In specific implementation, when the system or device fails, the traffic access and preprocessing module 71 will switch to the bypass mode, so as not to affect the normal operation of the network system.

[0123] The log analysis module 75 is used to generate network logs based on network traffic, and to analyze and mine multi-dimensional high-quality intelligence information, to build a knowledge graph centered on people, institutions, groups and events, to mine correlation relationships, to analyze network behavior, and to interact with intelligent retrieval. The network full traffic log data adopts a three-dimensional log generation method, which is specifically divided into a communication log dimension, a user log dimension and a content log dimension.

[0124] It can be understood that the operation steps of each module of the above-mentioned internet traffic classification device do not represent that the corresponding module can only perform the corresponding operation steps. For each module, the operation steps in other modules can also be performed, and the present embodiment does not limit this. For example, the traffic classification module can also perform the operation steps of accessing traffic and collecting session flow.

[0125] Please refer to Figure 8 , Figure 8 is a block diagram of an internet traffic classification device according to an example embodiment, as Figure 8 shown, the present application provides an internet traffic classification device 8, which comprises a memory 81, a processor 82 and a computer program stored on the memory 81 and running on the processor 82, and the processor 82 executes the computer program to realize the above-mentioned method.

[0126] Regarding the Internet traffic classification device 8 in the above embodiments, the specific execution process of its memory 81 and processor 82 has been described in detail in the embodiments related to the method, and will not be elaborated here.

[0127] Furthermore, this application provides a computer-readable storage medium storing computer instructions for causing a computer to perform the steps of any of the methods described above. The storage medium may be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium may also include combinations of the above types of memory.

[0128] It is understood that the same or similar parts in the above embodiments can be referred to each other, and the contents not described in detail in some embodiments can be referred to the same or similar contents in other embodiments.

[0129] It should be noted that in the description of this application, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this application, unless otherwise stated, "multiple" or "more" means at least two.

[0130] It should be understood that when an element is referred to as "fixed to" or "set on" another element, it may be directly on the other element or may have an intervening element present at the same time; when an element is referred to as "connected to" another element, it may be directly connected to the other element or may have an intervening element present at the same time. In addition, the term "connected" as used herein may include wireless connections; the word "and / or" as used includes any unit and all combinations of one or more of the associated listed items.

[0131] Any process or method description in the flowchart or otherwise herein can be understood as: representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the function involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0132] It should be understood that various parts of the present application can be implemented in hardware, software, firmware or a combination thereof. In the above embodiments, various steps or methods can be implemented in software or firmware that is stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, any of the following technologies, known in the art, or their combinations, can be used to implement the hardware: discrete logic circuitry having logic gates for implementing logic functions on data signals, application specific integrated circuits having appropriate combinational logic gates, programmable gate arrays (PGA), field programmable gate arrays (FPGA), and the like.

[0133] Those skilled in the art can understand that all or part of the steps carried out by the above-mentioned embodiment methods can be completed by programs instructing related hardware, and the programs can be stored in a computer readable storage medium, and when the programs are executed, one or a combination of the steps of the method embodiments is included.

[0134] In addition, each functional unit in each embodiment of the present application can be integrated into one processing module, or each unit can be physically present alone, or two or more units can be integrated into one module. The above-mentioned integrated module can be realized in the form of hardware or in the form of a software function module. The integrated module, if realized in the form of a software function module and sold or used as an independent product, can also be stored in a computer readable storage medium.

[0135] The above-mentioned storage medium can be a read-only memory, a magnetic disk or an optical disk, etc.

[0136] In the description of the present specification, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example" or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative description of the above terms does not necessarily mean the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0137] Although the embodiments of the present application have been shown and described above, it should be understood that the above-mentioned embodiments are exemplary and cannot be understood as limiting the present application, and those skilled in the art can make changes, modifications, replacements and variations to the above-mentioned embodiments within the scope of the present application.

Claims

1. A method of classifying Internet traffic, characterized by, The method comprises: obtaining a traffic training data set; determining a first data packet sequence from the traffic training data set in units of session flows, wherein one session flow corresponds to one first data packet sequence; model training is performed on a first to-be-trained model according to the first data packet sequence to obtain a trained flow feature multi-layer perception machine classification model, and model training is performed on a second to-be-trained model according to the first data packet sequence to obtain a trained flow data multi-layer perception machine classification model, comprising: performing length correction on the first data packet sequence to obtain a second data packet sequence of a preset length; determining an image set according to the second data packet sequence, comprising: constructing a first image according to the data packet arrival time and data packet size of the second data packet sequence; constructing a second image according to the data packet arrival time and data packet data preset length bytes of the second data packet sequence; and superimposing the first image and the second image to generate a dual-channel image; sending the image set into the second to-be-trained model for training to obtain the trained flow data multi-layer perception machine classification model; wherein the flow feature multi-layer perception machine classification model is used to obtain a flow feature classification result, the flow data multi-layer perception machine classification model uses an attention mechanism and a multi-layer perception machine to obtain a flow data classification result, and the flow feature classification result and the flow data classification result are used to integrate to obtain a final classification result; the second to-be-trained model at least comprises: an image block full connection layer, an attention perception layer, a global average pooling layer and a full connection layer; and sending the image set into the second to-be-trained model for training to obtain the trained flow data multi-layer perception machine classification model, comprising: converting the dual-channel image into a linearly flattened image piece sequence through the image block full connection layer; inputting the linearly flattened image piece sequence into the attention perception layer to enable the attention perception layer to perform at least one layer of attention perception layer operation on the linearly flattened image piece sequence to obtain an initial operation result; sequentially inputting the initial operation result into the global average pooling layer and the full connection layer to obtain a target operation result; based on the target operation result, model training is performed to obtain the trained flow data multi-layer perception machine classification model.

2. The method of claim 1, wherein, According to the first data packet sequence, a first to-be-trained model is subjected to model training to obtain a trained flow feature multi-layer perception machine classification model, comprising: obtaining flow feature information from the first data packet sequence data; sending the flow feature information into the first to-be-trained model for training to obtain the trained flow feature multi-layer perception machine classification model.

3. The method of claim 1, wherein, The flow feature classification result and the flow data classification result are specifically used to obtain the final classification result through model fusion.

4. The method of claim 1, wherein, The method further comprises: obtaining a to-be-predicted session flow data packet sequence corresponding to to-be-predicted traffic data; using the to-be-predicted session flow data packet sequence to perform model prediction on the flow feature multi-layer perception machine classification model and the flow data multi-layer perception machine classification model to obtain a model prediction result.

5. A method of classifying Internet traffic, characterized by, The method comprises: obtain a to-be-identified session flow data packet sequence corresponding to to-be-identified traffic; obtain a target flow feature classification result of the to-be-identified session flow data packet sequence based on the flow feature multi-layer perception machine classification model in claim 1; obtain a target flow data classification result of the to-be-identified session flow data packet sequence based on the flow data multi-layer perception machine classification model in claim 1; generate a target classification result of the to-be-identified session flow data packet sequence according to the target flow feature classification result and the target flow data classification result.

6. An Internet traffic classification apparatus characterized by comprising: comprise a traffic classification module; the traffic classification module is configured to execute the method in any one of claims 1-4.

7. An Internet traffic classification device characterized by, comprise: a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor executes the computer program to implement the method in any one of claims 1-4.

Images